Power Supply Fixes for 6.6 cycle

* core: fix use after free during device release
  * ab8500: avoid reporting multiple batteries to userspace
  * rk817: fix DT node resource leak
  * misc. small fixes, mostly for compiler warnings/errors
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE72YNB0Y/i3JqeVQT2O7X88g7+poFAmUWCd4ACgkQ2O7X88g7
 +prYdQ/9HyOx8cTOXEBtS9KaIXWSx1L14QMpNoToVPR9Gleg/EzSqW/DIh+m2U1a
 ZvIvvi86Yt+IY4JqQHEbdLgySahEwBLGqxPJaFjbWs5NVeQEIsSYfjwML+IrIrW+
 pDYQ+SUtJEGWxFdzaoLFlkaV0YZG6rzf0L6/Nk2gPdu9ODqKIF5kOFjmD5N43w2v
 spO/VZ+5ndYc6jxQZ8xHiO4NFxyLKVZ//CnVi+Axe/xZdw1V6+bC0FtLYT3V8y/S
 hUambJecvVR2qAIRg9nUdN6Z1YR8vjCaUmWpKS3NM6y0sq4XhW5VMLv8ezGvwd3M
 duhfHN6gZbL2vByIZ//E38qLmDGKYvWzFW12vkQf35/bttEh1ft7h70PgQg4iHl3
 lQu8iKsdR/VxrWGG+Z4eJ1YuZ55fKu+yvLkTltADJI73Wns4qhDWziLHoRa/RwCt
 0jKbeuPDVrVMhhTfVtBVdxCONkJJupQMCIp1Bl9JAadHR88TiUpYSuxQ8bIyicV/
 a1N8oeQTMCsV2G/wmu57/zyEzwX3azPtYPoX8KD3FLV3O8gQdMIn4FhjR6LxD/kB
 +3RqhHlQTlgpTuBtTKmpW6rKEjXNq+5/IFaDh1FKEYh6/sB9Rw1MmzqTM0+0CfHm
 cRLVYajws8VuI7MIU98kreu6X4P7SODHFyALpJ9mL6ywOlDWcrQ=
 =TAvZ
 -----END PGP SIGNATURE-----

Merge tag 'for-v6.6-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply

Pull power supply fixes from Sebastian Reichel:

 - core: fix use after free during device release

 - ab8500: avoid reporting multiple batteries to userspace

 - rk817: fix DT node resource leak

 - misc. small fixes, mostly for compiler warnings/errors

* tag 'for-v6.6-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply:
  power: supply: rk817: Fix node refcount leak
  power: supply: core: fix use after free in uevent
  power: supply: rt9467: Fix rt9467_run_aicl()
  power: supply: rk817: Add missing module alias
  power: supply: ucs1002: fix error code in ucs1002_get_property()
  power: vexpress: fix -Wvoid-pointer-to-enum-cast warning
  power: reset: use capital "OR" for multiple licenses in SPDX
  pwr-mlxbf: extend Kconfig to include gpio-mlxbf3 dependency
  power: supply: rt5033_charger: recognize EXTCON setting
  power: supply: mt6370: Fix missing error code in mt6370_chg_toggle_cfo()
  power: supply: ab8500: Set typing and props

drivers/power/reset/Kconfig

@@ -300,7 +300,7 @@ config NVMEM_REBOOT_MODE
 
 config POWER_MLXBF
 	tristate "Mellanox BlueField power handling driver"
-	depends on (GPIO_MLXBF2 && ACPI)
+	depends on (GPIO_MLXBF2 || GPIO_MLXBF3) && ACPI
 	help
 	  This driver supports reset or low power mode handling for Mellanox BlueField.
 

drivers/power/reset/pwr-mlxbf.c

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0-only or BSD-3-Clause
+// SPDX-License-Identifier: GPL-2.0-only OR BSD-3-Clause
 
 /*
  *  Copyright (c) 2022 NVIDIA CORPORATION & AFFILIATES.

drivers/power/reset/vexpress-poweroff.c

@@ -121,7 +121,7 @@ static int vexpress_reset_probe(struct platform_device *pdev)
 		return PTR_ERR(regmap);
 	dev_set_drvdata(&pdev->dev, regmap);
 
-	switch ((enum vexpress_reset_func)match->data) {
+	switch ((uintptr_t)match->data) {
 	case FUNC_SHUTDOWN:
 		vexpress_power_off_device = &pdev->dev;
 		pm_power_off = vexpress_power_off;

drivers/power/supply/Kconfig

@@ -769,6 +769,7 @@ config BATTERY_RT5033
 config CHARGER_RT5033
 	tristate "RT5033 battery charger support"
 	depends on MFD_RT5033
+	depends on EXTCON || !EXTCON
 	help
 	  This adds support for battery charger in Richtek RT5033 PMIC.
 	  The device supports pre-charge mode, fast charge mode and

drivers/power/supply/ab8500_btemp.c

@@ -115,7 +115,6 @@ struct ab8500_btemp {
 static enum power_supply_property ab8500_btemp_props[] = {
 	POWER_SUPPLY_PROP_PRESENT,
 	POWER_SUPPLY_PROP_ONLINE,
-	POWER_SUPPLY_PROP_TECHNOLOGY,
 	POWER_SUPPLY_PROP_TEMP,
 };
 
@@ -532,12 +531,6 @@ static int ab8500_btemp_get_property(struct power_supply *psy,
 		else
 			val->intval = 1;
 		break;
-	case POWER_SUPPLY_PROP_TECHNOLOGY:
-		if (di->bm->bi)
-			val->intval = di->bm->bi->technology;
-		else
-			val->intval = POWER_SUPPLY_TECHNOLOGY_UNKNOWN;
-		break;
 	case POWER_SUPPLY_PROP_TEMP:
 		val->intval = ab8500_btemp_get_temp(di);
 		break;
@@ -662,7 +655,7 @@ static char *supply_interface[] = {
 
 static const struct power_supply_desc ab8500_btemp_desc = {
 	.name			= "ab8500_btemp",
-	.type			= POWER_SUPPLY_TYPE_BATTERY,
+	.type			= POWER_SUPPLY_TYPE_UNKNOWN,
 	.properties		= ab8500_btemp_props,
 	.num_properties		= ARRAY_SIZE(ab8500_btemp_props),
 	.get_property		= ab8500_btemp_get_property,

drivers/power/supply/ab8500_chargalg.c

@@ -1720,7 +1720,7 @@ static char *supply_interface[] = {
 
 static const struct power_supply_desc ab8500_chargalg_desc = {
 	.name			= "ab8500_chargalg",
-	.type			= POWER_SUPPLY_TYPE_BATTERY,
+	.type			= POWER_SUPPLY_TYPE_UNKNOWN,
 	.properties		= ab8500_chargalg_props,
 	.num_properties		= ARRAY_SIZE(ab8500_chargalg_props),
 	.get_property		= ab8500_chargalg_get_property,

drivers/power/supply/mt6370-charger.c

@@ -324,7 +324,7 @@ static int mt6370_chg_toggle_cfo(struct mt6370_priv *priv)
 
 	if (fl_strobe) {
 		dev_err(priv->dev, "Flash led is still in strobe mode\n");
-		return ret;
+		return -EINVAL;
 	}
 
 	/* cfo off */

drivers/power/supply/power_supply_sysfs.c

@@ -482,6 +482,13 @@ int power_supply_uevent(const struct device *dev, struct kobj_uevent_env *env)
 	if (ret)
 		return ret;
 
+	/*
+	 * Kernel generates KOBJ_REMOVE uevent in device removal path, after
+	 * resources have been freed. Exit early to avoid use-after-free.
+	 */
+	if (psy->removing)
+		return 0;
+
 	prop_buf = (char *)get_zeroed_page(GFP_KERNEL);
 	if (!prop_buf)
 		return -ENOMEM;

drivers/power/supply/rk817_charger.c

@@ -1045,6 +1045,13 @@ static void rk817_charging_monitor(struct work_struct *work)
 	queue_delayed_work(system_wq, &charger->work, msecs_to_jiffies(8000));
 }
 
+static void rk817_cleanup_node(void *data)
+{
+	struct device_node *node = data;
+
+	of_node_put(node);
+}
+
 static int rk817_charger_probe(struct platform_device *pdev)
 {
 	struct rk808 *rk808 = dev_get_drvdata(pdev->dev.parent);
@@ -1061,11 +1068,13 @@ static int rk817_charger_probe(struct platform_device *pdev)
 	if (!node)
 		return -ENODEV;
 
+	ret = devm_add_action_or_reset(&pdev->dev, rk817_cleanup_node, node);
+	if (ret)
+		return ret;
+
 	charger = devm_kzalloc(&pdev->dev, sizeof(*charger), GFP_KERNEL);
-	if (!charger) {
-		of_node_put(node);
+	if (!charger)
 		return -ENOMEM;
-	}
 
 	charger->rk808 = rk808;
 
@@ -1211,3 +1220,4 @@ MODULE_DESCRIPTION("Battery power supply driver for RK817 PMIC");
 MODULE_AUTHOR("Maya Matuszczyk <maccraft123mc@gmail.com>");
 MODULE_AUTHOR("Chris Morgan <macromorgan@hotmail.com>");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:rk817-charger");

drivers/power/supply/rt9467-charger.c

@@ -598,8 +598,8 @@ static int rt9467_run_aicl(struct rt9467_chg_data *data)
 
 	reinit_completion(&data->aicl_done);
 	ret = wait_for_completion_timeout(&data->aicl_done, msecs_to_jiffies(3500));
-	if (ret)
-		return ret;
+	if (ret == 0)
+		return -ETIMEDOUT;
 
 	ret = rt9467_get_value_from_ranges(data, F_IAICR, RT9467_RANGE_IAICR, &aicr_get);
 	if (ret) {

drivers/power/supply/ucs1002_power.c

@@ -384,7 +384,8 @@ static int ucs1002_get_property(struct power_supply *psy,
 	case POWER_SUPPLY_PROP_USB_TYPE:
 		return ucs1002_get_usb_type(info, val);
 	case POWER_SUPPLY_PROP_HEALTH:
-		return val->intval = info->health;
+		val->intval = info->health;
+		return 0;
 	case POWER_SUPPLY_PROP_PRESENT:
 		val->intval = info->present;
 		return 0;